Microsoft ClickFix RunMRU Suspicious Command

Daniel Jeremiah@daniyyell

•updated Feb 20, 2026•2•0•23

This rule detects suspicious commands being set in the RunMRU registry key by explorer.exe. It specifically looks for the presence of LOLBins such as powershell, mshta, and curl, as well as obfuscation techniques like caret (^) and ProxyCommand, or patterns indicative of encoded/script execution (e.g., Invoke-Expression, FromBase64String, -eC). This activity is associated with the 'ClickFix' social engineering technique.